NPP1

Personal or sensitive information, including facts or opinions, must be collected in a fair and lawful manner and be necessary for the business. Necessary here means information that will increase the efficiency and effectiveness of our business. This may extend to such things as interests or anniversaries only if we can show this information is necessary for the building of the customer relationship.

There is information (known as NPP1.3 requirements) that you must provide to individuals when you collect their personal information. We do this by providing this information in 'Privacy statements' which are now included in all our application forms, both online and paper versions. There are occasions when personal information is collected outside of an application form so you must be aware of these requirements.

NPP3

We must take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, up to date and complete.

NPP5

We must be open about how we handle the personal information of customers and provide policy details with the VFS privacy policy brochure.

NPP8

Wherever it is lawful and practical, the privacy laws require that you must give your customers the option of not identifying themselves when entering into transactions with you, such as when exchanging bank notes for coins.

NPP10

Sensitive information is a subset of personal information and special protection applies. You need customer consent when you collect, use or disclose sensitive information such as health information. The privacy laws require that sensitive information must always be treated very carefully:

• It can only be collected with the individual's consent
• It should always be treated more securely than 'non-sensitive' personal information
• You must obtain the customer's consent for any form of use or disclosure.